{"id":3945404,"url":"https://alion.io/job/capgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect","title":"Sr. CyberArk PAM & EPM Implementation Engineer or Architect","company":{"id":145,"name":"Capgemini","domain":"capgemini.com","url":"https://alion.io/company/capgemini","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"B","score":79,"open_postings":1772,"ghost_share":0.005,"stale_share":0.819,"repost_share":0.017,"time_to_fill_p50_days":30,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Solutions","role_family":"Solutions","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Atlanta, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CyberArk","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"ITSM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Sentry","optional":false},{"name":"SIEM","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-06T00:39:19Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-11T02:11:29Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Choosing Capgemini means choosing a company where you will be empowered to shape your career in the way you’d like, where you’ll be supported and inspired by a collaborative community of colleagues around the world, and where you’ll be able to reimagine what’s possible. Join us and help the world’s leading organizations unlock the value of technology and build a more sustainable, more inclusive world.\nLocation\nThis role is based in the US.\nAbout The Job You're Considering\nWe are seeking an experienced Senior CyberArk PAM Implementation Engineer to assess, optimize, and enhance our existing CyberArk Privileged Access Management environment. The ideal candidate will have strong hands-on experience with CyberArk Cloud/SaaS and the ability to perform a comprehensive assessment of the existing PAM implementation, identify security and operational gaps, and develop a strategic roadmap for utilizing CyberArk capabilities to their fullest extent.\nThis role requires deep expertise in CyberArk PAM and Endpoint Privilege Manager (EPM), Secure Infrastructure Access (SIA), Just-in-Time (JIT) privileged access, application onboarding, password rotation, privileged session access, secrets management, and cloud integrations. The successful candidate will define the current-state architecture, recommend a target-state design based on CyberArk and industry best practices, and lead or support execution of the resulting roadmap.\nYour Role\n1. Existing CyberArk Environment Assessment\nPerform a comprehensive assessment of the existing CyberArk PAM environment.\nReview the current CyberArk architecture, configuration, integrations, policies, account onboarding processes, and operational procedures.\nIdentify security gaps, implementation deficiencies, unused capabilities, technical debt, and opportunities for optimization.\nEvaluate the effectiveness of privileged account onboarding, password rotation, session management, access controls, and privileged access workflows.\nAssess CyberArk platform health, scalability, resilience, availability, and operational maturity.\nReview the existing use of CyberArk Cloud capabilities and recommend improvements.\nDevelop a current-state assessment report, including findings, risks, recommendations, and remediation priorities.\n2. CyberArk Strategy and Roadmap\nDevelop a strategic PAM roadmap aligned with business requirements, cybersecurity objectives, and CyberArk best practices.\nDefine a target-state CyberArk architecture and implementation plan.\nDevelop a prioritized plan to maximize adoption and utilization of CyberArk capabilities.\nCreate implementation phases, dependencies, milestones, and technical requirements.\nDefine PAM use cases and prioritize systems, accounts, applications, and user populations for onboarding.\nDevelop a PAM maturity improvement plan.\n3. CyberArk Cloud / PAM Implementation\nImplement and optimize CyberArk Cloud/SaaS capabilities, including:\nPrivileged account management and onboarding\nAccount discovery and lifecycle management\nPassword rotation, verification, and reconciliation\nPrivileged session management and recording\nPrivileged session monitoring\nApplication credential management\nSecrets management\nPrivileged access request and approval workflows\nCloud infrastructure privileged access\nIntegration with enterprise identity and authentication platforms\n4. Secure Infrastructure Access (SIA)\nDesign, implement, and optimize CyberArk Secure Infrastructure Access (SIA).\nEnable secure, centralized access to infrastructure while minimizing exposure of privileged credentials.\nImplement secure access workflows for Windows, Linux, cloud infrastructure, and other supported platforms.\nIntegrate SIA with enterprise identity providers and authentication mechanisms.\nImplement role-based access controls for infrastructure access.\nDevelop standards and procedures for onboarding infrastructure to SIA.\nEvaluate existing administrative access methods and identify opportunities to reduce direct credential exposure.\nKey Responsibilties\n5.Just-in-Time (JIT) Privileged Access\nDesign and implement Just-in-Time (JIT) privileged access capabilities.\nImplement time-bound and controlled privileged access and reduce standing privileges where feasible.\nIntegrate JIT workflows with identity, ITSM, cloud, and authentication platforms where appropriate.\nDefine access request, approval, elevation, expiration, and revocation workflows.\nDevelop controls for privileged access to cloud and infrastructure environments.\nMonitor and optimize JIT access policies based on operational and security requirements.\n6.Application, System, and Account Onboarding\nLead onboarding of applications, systems, databases, platforms, and privileged accounts into CyberArk.\nAssess applications for password rotation, credential management, and secure access requirements.\nConfigure and implement password rotation, verification, and reconciliation.\nOnboard service accounts and application accounts into CyberArk.\nWork with application owners to implement credential retrieval and secure secrets consumption.\nEnable users to securely access systems and administrative portals through CyberArk.\nImplement session management and recording for supported systems.\nDevelop reusable onboarding patterns for Windows, Linux/Unix, databases, network devices, cloud platforms, SaaS applications, web portals, service accounts, application credentials, APIs, and machine identities.\nDesign, implement, and optimize CyberArk Endpoint Privilege Manager (EPM) to enforce least privilege and reduce local administrator rights.\nDevelop EPM application control and privilege elevation policies, including policy sets, rules, and baselines.\nPerform EPM discovery and assessment to identify excessive local administrator privileges and privilege elevation requirements.\nPlan and execute EPM agent deployment, phased rollout, and onboarding across Windows and supported endpoint platforms.\nImplement application elevation, application control, credential protection, and least-privilege policies.\nDefine and maintain EPM policy baselines and exception management processes.\nIntegrate EPM with enterprise identity, security monitoring, and IT operational processes where appropriate.\nMonitor EPM policy effectiveness, troubleshoot agent and policy issues, and continuously optimize configurations.\n7.Integrations and Automation\nIntegrate CyberArk with enterprise identity and authentication platforms.\nIntegrate CyberArk with cloud platforms and infrastructure services.\nWork with application teams to integrate applications with CyberArk secrets management capabilities.\nIntegrate CyberArk with ITSM, SIEM, monitoring, and ticketing platforms where required.\nDevelop automation for privileged account discovery, onboarding, reporting, and operational processes.\nUse PowerShell, Python, REST APIs, and CyberArk automation capabilities to improve efficiency.\n8.Standards, Governance, and Best Practices\nDevelop CyberArk architecture standards and implementation guidelines.\nDefine PAM onboarding standards and security requirements.\nDevelop SOPs and operational runbooks for CyberArk administration.\nDefine privileged account ownership and lifecycle processes.\nEstablish policies for password rotation, reconciliation, session recording, privileged access, and emergency access.\nDevelop privileged account inventory and classification standards.\nEnsure implementation aligns with CyberArk best practices and organizational security requirements.\nYour Skills And Experience\nTechnical Requirements\nRequired\nCyberArk PAM and CyberArk Cloud/SaaS\nPrivileged Account Security\nCentral Policy Manager (CPM)\nPrivileged Session Manager (PSM)\nPrivileged Session Manager for SSH (PSMP), where applicable\nPassword rotation and reconciliation\nPrivileged account onboarding\nApplication account and service account management\nSecrets management\nCyberArk Secure Infrastructure Access (SIA)\nJust-in-Time (JIT) privileged access\nPrivileged session access and recording\nREST API integration\nIdentity provider integration\nWindows and Linux privileged access\nStrongly Preferred\nCyberArk Endpoint Privilege Manager (EPM) design, implementation, policy development, deployment, and operational support\nPrivileged Threat Analytics (PTA), where applicable to the environment\nCyberArk application access and secrets capabilities\nAWS, Microsoft Azure, and/or Google Cloud integration\nKubernetes or container environments\nDevOps and CI/CD integrations\nITSM and SIEM integrations\nHands-on experience designing, deploying, configuring, and supporting CyberArk Endpoint Privilege Manager (EPM), including policy development, application control, privilege elevation, agent rollout, and operational optimization.\nExperience Requirements\nMinimum of 5-8 years of hands-on CyberArk PAM implementation and engineering experience.\nDemonstrated experience assessing an existing CyberArk environment and developing a remediation or enhancement roadmap.\nStrong hands-on experience with CyberArk Cloud/SaaS.\nDemonstrated implementation experience with CyberArk SIA.\nDemonstrated implementation experience with Just-in-Time privileged access.\nExperience onboarding complex applications and systems for password rotation, password reconciliation, session access, privileged session management, and secrets management.\nExperience integrating CyberArk with enterprise applications and cloud platforms.\nExperience migrating or transforming legacy privileged access processes into CyberArk-based workflows.\nStrong understanding of privileged account lifecycle management.\nExperience working with application owners, infrastructure teams, cloud teams, IAM teams, and vendors.\nEPM operational and exception-management procedures\nEPM application control and privilege elevation use-case catalogue\nEPM agent deployment and phased rollout plan\nEPM policy and baseline design\nEPM target-state architecture and deployment strategy\nEPM current-state assessment and maturity review\nPreferred Certifications\nRelevant CyberArk Defender certification\nRelevant CyberArk Sentry certification\nCyberArk Cloud-related training or certifications\nCyberArk PAM implementation or delivery credentials\nCISSP is beneficial but not mandatory for this hands-on engineering role\nRequired Deliverables\nCurrent-state CyberArk architecture assessment\nCyberArk health and configuration assessment\nPAM maturity and gap assessment\nPrivileged account inventory and classification\nTarget-state CyberArk architecture\nCyberArk Cloud adoption strategy\nSIA implementation strategy\nJIT implementation strategy\nApplication and service account onboarding framework\nPassword rotation onboarding plan\nSession access and portal access onboarding plan\nPrioritized remediation and implementation roadmap\nPAM standards and operating procedures\nUse-case catalogue\nIntegration architecture and implementation plan\nKnowledge-transfer and operational handover documentation\nThe base compensation range for this role in the posted location is: $110,880 - $180,400.\nCapgemini provides compensation range information in accordance with applicable national, state, provincial, and local pay transparency laws. The base compensation range listed for this position reflects the minimum and maximum target compensation Capgemini, in good faith, believes it may pay for the role at the time of this posting. This range may be subject to change as permitted by law.\nThe actual compensation offered to any candidate may fall outside of the posted range and will be determined based on multiple factors legally permitted in the applicable jurisdiction.\nThese may include, but are not limited to: Geographic location, Education and qualifications, Certifications and licenses, Relevant experience and skills, Seniority and performance, Market and business consideration, Internal pay equity.\nIt is not typical for candidates to be hired at or near the top of the posted compensation range.\nIn addition to base salary, this role may be eligible for additional compensatio...","description_format":"text","description_chars":15767,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","Systems Integrators","Management Consulting","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-11-08T19:09:34Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 2,076 · green card filings: 82","filings_12m":2076,"filings_prev_12m":2803,"green_card_filings_12m":82,"median_offered_wage_usd":132120,"route":null,"cap_exempt":false,"checked_at":"2026-11-10T11:34:35+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":351}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":4,"expected_fill_days":30,"reasons":["conf:2","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/capgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect","json_url":"https://alion.io/job/capgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect.json","meta":{"generated_at":"2026-11-11T02:35:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":832,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":145},"rest":"https://alion.io/mcp/rest/get_company?id=145"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcapgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcapgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcapgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/capgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcapgemini-sr-cyberark-pam-epm-implementation-engineer-or-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3945404}},{"tool":"search_jobs","arguments":{"company":"capgemini.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3945404},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}